Here's a rare piece of good news in the world of software licensing: in mid-2026, Microsoft quietly made your Microsoft 365 subscription more secure at no extra cost. Security tools that used to be paid add-ons are now bundled into the standard business licences.
The catch — and it's a big one — is that "included" doesn't mean "switched on." Most of these protections still have to be configured before they do anything. So a lot of Perth businesses are now, right now, paying for security features that are sitting completely dormant. Let's fix that.
What actually changed (from July 2026)
As of 1 July 2026, with the rollout completing across tenants by early August, Microsoft moved several previously premium capabilities into baseline licences:
Defender for Office 365 Plan 1 — the email-security layer that adds Safe Links (real-time checking of links when they're clicked), Safe Attachments (detonating attachments in a sandbox before delivery), and advanced anti-phishing — is now included in Microsoft 365 E3 and Office 365 E3. It was already part of Business Premium.
Intune Suite capabilities — including Remote Help, Advanced Analytics and Intune Plan 2 device-management features — are now bundled into Microsoft 365 E3 and E5, instead of a separate add-on.
Even the lower tiers benefit: plans like Business Basic, Business Standard and Office 365 E1 picked up baseline URL link-checking protection across Outlook and the Office apps — a meaningful lift to the floor of everyone's security.
In plain terms: Microsoft raised the default security baseline for small and medium businesses. If you pay for a business M365 plan, you almost certainly gained something.
What you now have — by plan
Not sure what applies to you? Roughly:
Business Basic / Business Standard: you now get link-checking protection in Outlook and Office. It's not the full Defender suite, but it's a genuine improvement — and a good moment to ask whether you need the stronger protection above.
Business Premium: you already had Defender for Office 365 Plan 1 — Safe Links, Safe Attachments and anti-phishing. The real question here isn't whether you have it; it's whether it's actually turned on and configured (more on that below).
Microsoft 365 E3: this is the big winner — you just gained Defender for Office 365 Plan 1 and the Intune Suite features that previously cost extra. That's real money and real capability now included.
The trap: included ≠ enabled
This is the part that catches businesses out, and it's exactly the kind of gap we wrote about in the four IT gaps small businesses overlook.
Having Defender for Office 365 in your licence does not mean Safe Links and Safe Attachments are protecting your inboxes. Those are policies that have to be created and applied to your users — out of the box, they're not automatically enforcing anything. We regularly review Perth tenants that have been entitled to this protection for months, paying for it the whole time, with not a single policy configured. The licence line item was there; the protection wasn't.
It's the same story as unused MFA or untested backups: the tool exists, but nobody switched it on, so the business carries the cost and none of the benefit.
What to do this week
You can turn dormant licensing into real protection with a short, focused piece of work:
Confirm your plan. Check which Microsoft 365 licence your business actually holds — Basic, Standard, Premium or E3. This decides what you're entitled to.
Check whether the protection is configured, not just licensed. In the Microsoft security portal, confirm there are active Safe Links, Safe Attachments and anti-phishing policies applied to all users — not just present, but enforced.
Enable what you're paying for. If you're on Business Premium or E3 and the policies aren't set up, that's the single highest-value security job you can do right now — you've already bought it.
Use the Intune features if you're on E3/E5 — Remote Help and modern device management are genuinely useful and now cost you nothing extra.
Don't assume the baseline is enough. The lifted floor is great, but link-checking alone isn't a full security stack. Pair it with MFA everywhere, staff awareness, and the rest of the ASD Essential Eight.
The takeaway
Microsoft has handed Perth businesses a free security upgrade — but a free upgrade that stays switched off protects no one. The businesses that benefit are the ones that go and enable and configure what they now have.
If you're not sure what's in your licence or whether it's actually protecting you, that's exactly the kind of review we do as part of managing Microsoft 365 — we'll tell you what you're entitled to, what's turned on, and what's quietly costing you money while doing nothing. Talk to the Computer Mechanics team or call (08) 9325 1196. We've helped Perth businesses get real value from their IT since 1997 — and switching on the security you've already paid for is about the best return there is.
